MAL-2026-12060 Malicious code in beaver-ui-card-large (npm)

Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap() on process.nextTick so the payload runs when the module is loaded. bootstrap() selects a platform-specific asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and invokes lib/telemetry.js run(…) to download the binary from a hardcoded pool of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS fallback to *.dl.well1.site (tin/tina/ldr/win subdomains). The downloaded file is written to /var/tmp or %TEMP%, chmod'd to 0755, and executed. Host, URL, and OS API strings are assembled at runtime from split arrays (e.g. ['oob-wor','ker.cf','99-9b3.wor','kers','.dev'].join(''); os'plat'+'form'; fs'chmod'+'Sync') to evade static analysis, and the module is labeled 'Analytics SDK' with a DISABLE_TELEMETRY opt-out as cover. Alongside the fetch, setup.js builds an installer fingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid and passes it as installId with the request. There is no version pinning, no signature or hash check, and the fetched content bears no relation to the advertised React-component purpose.